Bug 1471544 - SELinux Troubleshooter reports should use absolute paths
Summary: SELinux Troubleshooter reports should use absolute paths
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: setroubleshoot
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1471540 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-07-16 19:47 UTC by Audrey Yeena Toskin
Modified: 2018-03-06 16:26 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-03-06 16:26:37 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Audrey Yeena Toskin 2017-07-16 19:47:28 UTC
After making a fresh installation of Fedora 26 Workstation x86_64, I started to restore local file backups, including my entire home directory, virtual machines from /var/lib/libvirt/, /root/.bashrc, and a few things in /etc/, using rsync. During this operation, I hit *a lot* of SE Linux alerts, including this one, plus others that have already recently been reported.

SETroubleshoot reports "SELinux is preventing /usr/lib/systemd/systemd-journald from search access on the directory root... root default label should be syslogd_var_run_t." It recommends running

    /sbin/restorecon -v root

But there is/was no `root/` in my current working directory or home directory. I was restoring backups *from* a directory called root on another hard drive, which matches the filesystem hierarchy of /, so that I can rsync the files and folders I mentioned above in one go, like this:

    rsync \
      # Preserve file owner, timestamp, permissions, sparseness
      --archive --sparse --executability --acls --xattrs \
      # Display and save transfer progress
      --partial --info=name,progress2 --log-file="$log_file" \
      # Source and destination:
      $backup_device/root/  /

If "root" refers to that directory, then the recommended restorecon command should have specified the full path. Also, when I tried restorecon on the backup directory, it just says "Warning no default label for $backup_device/root/".

If "root" means either / or /root/, then I'm also not sure how the context of either of those directories could have gotten messed up, since rsync has no options to preserve the SELinux file context, so it's not like I was duplicating incorrect contexts from my backups, and I only copied one file in /root/ anyway.

Comment 1 Audrey Yeena Toskin 2018-02-27 02:06:49 UTC
So to summarize, SELinux Troubleshooter should use the full absolute path in its reports and suggested `restorecon` commands.

Comment 2 Audrey Yeena Toskin 2018-02-27 02:08:43 UTC
*** Bug 1471540 has been marked as a duplicate of this bug. ***

Comment 3 Daniel Walsh 2018-03-01 19:20:08 UTC
Sadly the kernel does not give us the full path in a lot of situations. So setroubleshoot can only devine so much.  you can turn the kernel auditing up to record full paths but there is a heavy performance penalty.

Comment 4 Lukas Vrabec 2018-03-06 16:26:37 UTC
As was mentioned in comment#3. There are several issues to do that. Because of these reasons, I'm closing this ticket as CANTFIX.


Note You need to log in before you can comment on or make changes to this bug.